Vulnerability, Threat & Exposure Management Analyst

b Overview /b p In this role you help ASOS understand and reduce technology exposures that drive cyber risk. You translate security data into risk-based priorities for engineering and product teams. You’ll assess exposures across modern tech, including cloud, applications and identities, and guide proportionate remediation. You collaborate across teams to improve ASOS’s threat and exposure management capability and promote secure-by-design practices. This is a hands-on, analytical role with meaningful impact on reducing material cyber risk. /p b Pay / Benefits /b ul li Employee discount /li li Employee sample sales /li li 25 days paid annual leave + extra celebration day /li li Discretionary bonus scheme /li li Private medical care scheme /li li Flexible benefits allowance /li /ul b Responsibilities /b ul li Identify and assess exposures across ASOS (vulnerabilities, misconfigurations, identity/privilege weaknesses, exposed assets/services, cloud risks, attack paths) /li li Perform risk-based prioritisation considering exploitability, threat intel, asset criticality and business context /li li Analyse attack paths to understand how weaknesses enable compromise of critical assets /li li Apply threat intelligence to prioritise actions /li li Assess exposures across cloud, APIs, containers, VMs, endpoints, networks and infrastructure /li li Support continuous attack-surface discovery and unknown asset identification /li li Partner with engineering/product/platform/infrastructure to agree proportionate remediation /li li Track exposures to resolution and escalate material risk when needed /li li Identify recurring patterns and root causes to reduce exposure classes /li li Assess effectiveness of controls and validate remediation outcomes /li li Translate findings into clear risk insights for technical and non-technical stakeholders /li li Contribute to exposure metrics and reporting showing risk reduction /li li Contribute to continuous improvement of Threat Exposure Management (automation, data enrichment, governance) /li li Promote secure-by-design and proportionate security practices across teams /li /ul b Key requirements /b ul li Relevant experience as Vulnerability Analyst or SOC Analyst or similar /li li Understanding of common vulnerability types and attack techniques /li li Experience with vulnerability management and security assessment tools (e.g., Wiz, Defender, Nessus, Qualys) /li li Understanding of enterprise tech including cloud platforms, networking and software development /li li Ability to leverage threat intelligence to inform remediation priorities /li li Knowledge of container and Kubernetes security desirable /li li Understanding of cyber security risk management and risk-based decisions /li li Excellent written and verbal communication for non-technical audiences /li li Naturally inquisitive with strong problem-solving and critical thinking /li /ul ul li collaborative /li li analytical thinking /li li clear communication /li li vulnerability management /li li cloud security /li li security assessment tooling (Wiz, Defender, Nessus, Qualys) /li /ul